В браузерах при нажатии на ссылки/на любое место на странице открывается окно с рекламой/левого сайта

begin
 ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 StopService('BAPIDRV');
 QuarantineFile('C:\Windows\system32\DRIVERS\BAPIDRV64.sys','');
 QuarantineFile('C:\Users\олег-ПК\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk','');
 QuarantineFile('C:\Users\олег-ПК\Favorites\Links\Интернет.url','');
 QuarantineFile('C:\Users\олег-ПК\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe', '');
 DeleteFile('C:\Windows\system32\DRIVERS\BAPIDRV64.sys','32');
 DeleteFile('C:\Users\олег-ПК\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe','32');
 DeleteFile('C:\Users\олег-ПК\Favorites\Links\Интернет.url','32');
 DeleteFile('C:\Users\олег-ПК\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk','32');
 DeleteService('BAPIDRV');
 DelBHO('{D5FEC983-01DB-414A-9456-AF95AC9ED7B5}');
 ExecuteSysClean;
 ExecuteRepair(4);
 ExecuteWizard('SCU',2,3,true);
 RebootWindows(true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} =>  No File
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} =>  No File
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
GroupPolicy-x32: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2165152048-623656956-1565829505-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1410514064&from=cor&uid=ST3500412AS_5VV21S72XXXX5VV21S72&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1410514064&from=cor&uid=ST3500412AS_5VV21S72XXXX5VV21S72&q={searchTerms}
Toolbar: HKU\S-1-5-21-2165152048-623656956-1565829505-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-2165152048-623656956-1565829505-1000 -> No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
Toolbar: HKU\S-1-5-21-2165152048-623656956-1565829505-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKU\S-1-5-21-2165152048-623656956-1565829505-1000 -> No Name - {F23E2FD6-D25D-4C52-8669-2B9C0133D6EE} -  No File
Toolbar: HKU\S-1-5-21-2165152048-623656956-1565829505-1000 -> No Name - {49D931C3-97C7-46BF-850F-83CC98E81623} -  No File
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  No File
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1410514064&from=cor&uid=ST3500412AS_5VV21S72XXXX5VV21S72
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF Extension: 360 İnternet Koruması - C:\Program Files (x86)\360\Total Security\safemon\webprotection_firefox [2014-11-06]
FF Extension: No Name - C:\Users\олег-ПК\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\vb@yandex.ru [Not Found]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\олег-ПК\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR HKLM-x32\...\Chrome\Extension: [aapcjgafljhokjfbeebpiddfjpjjcdem] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [akkhkcocfnopiccplnimkefmaejepdlj] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bagkmcapnndnncpcocmfplbdejejlgig] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [cbhneibcbgciicaihkefieefieeldnil] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cmocclkgkjfmpcfmeimdkboillapkkpl] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hbpohbeflieibmcmohdnhfkigfmkmfgd] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iljgconplfkpjboopgbakcefackepgio] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lonndeeklpobbkjaacljjjkddafbbbfa] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ochbjojkpcmlfeagbaahkofepalngihg] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh] - http://clients2.google.com/service/update2/crx
Task: {4E2AC5C5-F893-4143-BFCE-684F14AEBFD5} - \Программа онлайн-обновления Real Player. No Task File <==== ATTENTION
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Microsoft:QU2RqvdxTix8aYhvzENBS
AlternateDataStreams: C:\ProgramData\Microsoft:RGEFNxQXdFRQfbV3f8Ka
AlternateDataStreams: C:\ProgramData\Microsoft:WpBbVVLCfQUPDWeCKTIDjICH
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51
AlternateDataStreams: C:\ProgramData\TEMP:41ADDB8A
AlternateDataStreams: C:\ProgramData\TEMP:A064CECC
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:QU2RqvdxTix8aYhvzENBS
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:RGEFNxQXdFRQfbV3f8Ka
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:WpBbVVLCfQUPDWeCKTIDjICH
AlternateDataStreams: C:\Users\Все пользователи\TEMP:1CE11B51
AlternateDataStreams: C:\Users\Все пользователи\TEMP:41ADDB8A
AlternateDataStreams: C:\Users\Все пользователи\TEMP:A064CECC
AlternateDataStreams: C:\Users\олег-ПК\Local Settings:wa
AlternateDataStreams: C:\Users\олег-ПК\AppData\Local:wa
AlternateDataStreams: C:\Users\олег-ПК\AppData\Local\Application Data:wa
AlternateDataStreams: C:\Users\олег-ПК\AppData\Local\Temporary Internet Files:5pDoxFYASUHzHmA3S6dDHKbd
EmptyTemp:
Reboot:
end

start
OPR Extension: (Radio Canyon) - C:\Users\олег-ПК\AppData\Roaming\Opera Software\Opera Stable\Extensions\bikofacodmhdpkfdeeocponfcgjcdfbk [2014-11-06]
OPR Extension: (Dolka.ru) - C:\Users\олег-ПК\AppData\Roaming\Opera Software\Opera Stable\Extensions\pheobeikgpfdjfnlnhinkcogflmkcmlc [2014-06-13]
Reboot:
end

var
LogPath : string;
ScriptPath : string;
begin
 LogPath := GetAVZDirectory + 'log\avz_log.txt';
 if FileExists(LogPath) Then DeleteFile(LogPath);
 ScriptPath := GetAVZDirectory +'ScanVuln.txt';
  if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 1) then ExecuteScript(ScriptPath) else 
begin
    if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 0) then ExecuteScript(ScriptPath) 
else begin
       ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
       exit;
      end;
  end;
 if FileExists(LogPath) Then ExecuteFile('notepad.exe', LogPath, 1, 0, false)
end.